1. Basic requirement: substantial connection between the offence and the company
A company can be held criminally liable under the VbVG if either
- an offence has been committed in the interest of the company; or
- duties concerning the company have been violated by the offence.
An offence is committed "in the interest of the company" inter alia if the company receives a direct pecuniary advantage as a result. However, indirect advantages for the company like an improvement of its competitive situation or a reduction of expenses also can be regarded as such an advantage, which leads to a rather broad understanding of "in the interest of the company". The advantage does not actually have to occur, as even the attempt to commit an offence in the interest of the company can be punishable.
A "violation of duties concerning the company" basically includes any violation of statutory and/or contractual obligations that the company has to comply with. In general, the duties the company has to observe depend on the company's field of activities and must be assessed on a case-by-case basis.
2. The perpetrator: employee or decision-maker
If the perpetrator is considered an employee, for the company to be criminally liable there has to have been basically an act of negligence on the side of decision-makers regarding the supervision of that employee. This would be the case if the company does not have effective organisational or technical measures to prevent employees from committing criminal misconduct in place. It is important to note that the company can be held criminally liable even if it is impossible to identify the employee(s) who committed the crime. According to the VbVG's parliamentary materials, it is sufficient to establish a category of employees in which the criminal act was committed.
If the perpetrator is considered a decision-maker (eg member of the management or supervisory board), criminal liability under the VbVG generally requires that the decision-maker has to have committed the offence in his function as a decision-maker of the company. This will be "quasi-undeniably" regarded as negligent conduct of the company. Whether the criminally liable decision-maker must be identified in person remains a topic of debate in the academic literature.
3. Confirmation of the VbVG by the Austrian Constitutional Court and Supreme Court
As reported in our Legal Insights dated 9 January 2017, the VbVG had been challenged before the Austrian Constitutional Court due to various constitutional reasons in December 2016. However, the Austrian Constitutional Court confirmed the constitutionality of the VbVG and the Austrian Supreme Court recently applied the VbVG again referring to (and thus implicitly confirming) the decision of the Austrian Constitutional Court (11 Os 10/16d).
Austrian prosecution authorities welcomed the decision. It was said that the decision would encourage prosecutors to instigate criminal proceedings against companies, even if no concrete decision-maker or employee can be identified as the perpetrator. In this sense, it would suffice that the criminal act can be traced back to the company.
This possible future approach by the prosecution authorities significantly widens the scope and applicability of the VbVG. In the past, the criminal liability of the company was only the authorities' "second shot" after establishing the criminal conduct of an employee/decision-maker. Now the company itself will likely be the primary target of the criminal prosecution, if a criminal act can be related to the company.
Companies should therefore take all measures to avoid any criminal misconduct that could be related to the company.
4. Strategies to avoid criminal liability under the VbVG
The VbVG imposes fines of up to EUR 1.8 million on companies. Victims can additionally pursue damage claims against the company in criminal proceedings (Privatbeteiligung). Therefore, taking into account the new tendencies of prosecutors, companies are well-advised to implement strategies to avoid criminal liability under the VbVG.
4.1 Effective internal compliance systems
Companies should implement internal compliance systems to avoid criminal misconduct from the beginning, like detailed rules on internal reporting and decision-making. Such internal systems can decrease the risk of a court finding that there has been a lack of due diligence regarding the prevention of offences committed by employees.
4.2 Leniency programme / Internal investigations
Since not even the most efficient compliance system can completely eliminate the risk of internal criminal misconduct, companies should be prepared if an actual case of criminal liability under the VbVG comes up. As reported in our Legal Insights dated 2 November 2016, the Austrian Criminal Proceedings Code provides for a leniency programme, which also applies to companies. One of the prerequisites for applying the leniency programme is that the perpetrator offers new and relevant information to the prosecutor in order to facilitate the authority's investigation.
Therefore, companies are well-advised to implement internal systems and measures to obtain such information and thereby set up the groundwork for the application of the leniency programme. Such measures could include rules and measures regarding internal investigations, such as guidelines for interviewing employees and decision-makers or searches of company data in order to quickly clarify allegations.
5. Being prepared is half the battle
Companies should always be prepared for the worst-case scenario, namely when the prosecutor knocks on the door with serious allegations that an employee or decision-maker committed an offence connected to the company. In that situation, it is essential to have clear and efficient internal guidelines and procedures to mitigate the risk of the company's criminal liability under the VbVG.